Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonichi/sutando --skill deal-findergit clone --depth 1 https://github.com/sonichi/sutandoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonichi/sutando/deal-finder)<a href="https://agentmods.dev/skills/sonichi/sutando/deal-finder"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/deal-finder/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonichi/sutando/deal-finder"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/deal-finder.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.00791 |
| Opus 5 | $0.00033 | $0.00396 |
| Sonnet 5 | $0.00013 | $0.00158 |
| Haiku 4.5 | $0.00007 | $0.00079 |
Grade A, and why
deal-finder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deal Finder
Watches configured sources for second-hand item listings matching owner-defined criteria. Sends an SMS + Telegram DM when a new matching listing appears.
Usage: /deal-finder (one-shot scan) — typically run from cron every 60 min.
Searches
V1 keeps the original Mac Mini search inline (state/criteria.json). V2 will move this to a state/searches.json array with one entry per search, so adding "Pelican 1535 case", "Aeron chair size B", etc. becomes a JSON edit rather than a code change.
Current Mac Mini search criteria (from state/criteria.json):
- Chip family:
M2,M3,M4(M1 explicitly excluded — owner asked for M2+) - Min RAM:
16 GB - Min storage:
512 GB - Max price:
$500 - ZIP:
94566(Pleasanton, CA), search radius50 mi
Edit state/criteria.json to retune the Mac Mini search; v2 will lift this into a per-search config.
Sources
V1 (implemented): Craigslist (sfbay.craigslist.org/search/sss?...). Uses an honest User-Agent (Sutando-Personal-Agent/1.0) that identifies the agent rather than cosplaying a browser — Craigslist can decide whether to allow.
V2 (planned, not yet implemented):
- eBay —
browse.ebay.comhas a local-pickup filter; HTML scraping works without auth. - Facebook Marketplace — requires a headless browser (Playwright via the
macos-useskill, or the browser-automation MCP) because the page is JS-rendered and gated.
Behavior
- Fetch the Craigslist search results page with the honest UA.
- Parse each listing: title, URL, price, neighborhood.
- For each listing not in
state/seen.json:- Fetch the listing detail page (one extra HTTP req per listing — cheap, only on first sight).
- Apply criteria filter (chip, RAM, storage, price). Listings missing fields fall through to "soft match" — flagged but still notified, since Craigslist sellers often omit specs.
- On match: notify (SMS + Telegram), record URL in
seen.json.
- Trim
seen.jsondeterministically to the last 1000 entries (adeque(maxlen=1000)ordered by insertion — replaces the prior set-slicing trim which was non-deterministic).
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 65 lines · 66 tokens per session scan A 0e906a6da526
deal-finder is a skill published in the GitHub repository sonichi/sutando (394 stars, last pushed today), licensed MIT. It adds 66 tokens to every session and 791 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
doordash
Order food, groceries, and convenience items from DoorDash using the built-in CLI integration.
amazon
Shop on Amazon and Amazon Fresh through your browser.
gmail
Manage Gmail email — drafting, sending, organizing, filters, vacation replies, and inbox analysis.
app-builder
Build and edit small, personal visual tools and artifacts — dashboards, trackers, calculators, data visualizations, charts, simple landing pages, and slide decks the user wants for THEMSELVES. This is the right skill whenever the user asks to "visualize this," "make a chart," or "build an artifact" for their own use…
assistant-migration
Migrate from ChatGPT, Claude, OpenClaw, Hermes, Manus, and other AI assistants into Vellum by inspecting their data exports, conversation archives, files, prompts, custom instructions, memory, saved memories, tools, GPTs, workflows, integrations, and relationships, then mapping as much as safely possible into Vellum…
guardian-verify-setup
Set up channel verification for phone, Telegram, Slack, Discord, or email channels via outbound verification flow.